mirror of
https://github.com/cloudflare/cloudflared.git
synced 2026-08-07 07:14:57 +00:00
Rhys Rustad-Elliott
12e11208ae
As with recent changes with Linux and MacOS, use --token-file instead of --token when installing the service for Windows. The secret token was viewable by an unprivileged user by looking at the registry entry HKLM\\SYSTEM\\CurrentControlSet\\Services\\Cloudflared\\ImagePath, which stores the full command-line invocation of cloudflared (complete with --token ). We fix this by storing the token in a file and restricting access to it. The canonical way of protecting a secret token on Windows is to use the CryptProtectData and CryptUnprotectData functions in dpapi.h, which encrypt/unencrypt data using an OS-managed secret key. See here: https://learn.microsoft.com/en-us/windows/win32/api/dpapi/ While we could use the DPAPI to encrypt/decrypt the token before writing it out to disk, this has two problems: 1) We would break existing Windows installs using --token-file with an unencrypted token file 2) We would introduce an inconsistency between how --token-file works on Linux/MacOS and Windows Because of this, we keep things consistent and just add logic to cloudflared to protect the token file by modifying the permissions of the token file. Windows's permission model differs completely from Linux and MacOS, so a Windows-specific function is used to restrict the token file's permissions. We strip ACLs from the file such that it's only readable by SYSTEM and Administrators. Also done by this MR: * Improve "service install --help" output on Windows to be in-line with Linux and MacOS * Change uses of path.Join that work with file paths to be filepath.Join instead, which will use the correct platform-specific path separator (\\ on windows or / on \*nix) instead of only forward slashes * Pull out constant string in MacOS service